Privacy policy

Gridhub is designed so that your financial, business and health records are readable by you and nobody else. This page explains what we store, why, and what you can do about it. It is written to be understood, not to hide behind length.

1. What we collect

• Account data: your email address, display name and avatar from Google sign-in, plus a user id.
• Workspace records: the records you create in the tools you use — transactions, invoices, guests, meals, tasks and so on.
• Preferences: currency, locale, time zone, theme and dashboard layout.
• Billing data: Stripe customer and subscription identifiers, plan, status and renewal date. Card details are handled by Stripe and never reach our servers.
• Approximate location: when you use the signed-in workspace, we record the country code supplied by our hosting provider. We use it to understand aggregate country-level usage for product and marketing planning. We do not store your IP address or precise location for this feature.
• Operational data: sync errors and basic request logs used to keep the service working.

2. What we do not collect

• We do not send transaction descriptions, invoice contents, guest names or nutrition entries to marketing or advertising tools.
• We do not sell personal data.
• We do not use your records to train third-party models.

3. Where data lives

Records are written to your device first (IndexedDB) and synchronised to your private Supabase workspace. Row-level security policies restrict every row to its owning user. Billing tables are writable only by server-side webhook processing, never by the browser. Country activity is held separately for aggregate reporting and is removed when your account is deleted.

4. Processors

• Supabase — authentication, Postgres database and storage.
• Stripe — subscription billing, invoicing and the customer portal.
• Hosting provider — serves the application; records are not cached in shared public caches.

5. Retention

Workspace records are retained while your account exists, including after a subscription ends, so you can export or reactivate. Billing records are retained as required for tax and accounting. Deleting your account removes your workspace records and local cache.

6. Your rights

• Export all of your records as JSON or per-table CSV, at any time, on any plan.
• Delete your account and workspace records from Settings.
• Request correction or a copy of your data by email.

7. Cookies and local storage

We use a session cookie for authentication and local storage for your offline records and preferences. We do not use advertising cookies. Analytics, where enabled, are aggregate and do not include record contents.

8. Children

Gridhub is not intended for children under 16 and we do not knowingly collect their data.

9. Changes and contact

Material changes will be announced in the product before they take effect. Privacy questions can be sent to the support address listed on the contact page.